{
  "updated": "2026-09-22T18:35:59.235Z",
  "rubric": "/trust/#rubric",
  "items": [
    {
      "cve": "CVE-2026-7273",
      "vendor": "Zyxel",
      "product": "GS1900 Series Switches",
      "name": "Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability",
      "dateAdded": "2026-09-21",
      "dueDate": "2026-09-24",
      "ransomware": false,
      "cvss": 8.8,
      "epss": 0.01987,
      "verdict": "act",
      "score": 103,
      "reasons": [
        "On CISA KEV (confirmed exploitation in the wild)",
        "CISA remediation deadline in 1 day(s)",
        "CVSS 8.8 (high)"
      ],
      "action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follo",
      "oneLine": "Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability — Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s .",
      "stacks": [],
      "ageDays": 2,
      "rank": 1,
      "movement": "up",
      "daysOnList": 6
    },
    {
      "cve": "CVE-2026-42016",
      "vendor": "JFrog",
      "product": "Artifactory",
      "name": "JFrog Artifactory Incorrect Authorization Vulnerability",
      "dateAdded": "2026-09-11",
      "dueDate": "2026-09-25",
      "ransomware": false,
      "cvss": null,
      "epss": null,
      "verdict": "act",
      "score": 88,
      "reasons": [
        "On CISA KEV (confirmed exploitation in the wild)",
        "CISA remediation deadline in 2 day(s)"
      ],
      "action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follo",
      "oneLine": "JFrog Artifactory Incorrect Authorization Vulnerability — Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s .",
      "stacks": [],
      "ageDays": 12,
      "rank": 2,
      "movement": "up",
      "daysOnList": 6
    },
    {
      "cve": "CVE-2026-42018",
      "vendor": "JFrog",
      "product": "Artifactory",
      "name": "JFrog Artifactory Improper Authentication Vulnerability",
      "dateAdded": "2026-09-11",
      "dueDate": "2026-09-25",
      "ransomware": false,
      "cvss": null,
      "epss": null,
      "verdict": "act",
      "score": 88,
      "reasons": [
        "On CISA KEV (confirmed exploitation in the wild)",
        "CISA remediation deadline in 2 day(s)"
      ],
      "action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follo",
      "oneLine": "JFrog Artifactory Improper Authentication Vulnerability — Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s .",
      "stacks": [],
      "ageDays": 12,
      "rank": 3,
      "movement": "up",
      "daysOnList": 6
    },
    {
      "cve": "CVE-2026-76461",
      "vendor": "Cisco",
      "product": "Secure Email Gateway",
      "name": "Cisco Secure Email Gateway SQL Injection Vulnerability",
      "dateAdded": "2026-09-14",
      "dueDate": "2026-09-17",
      "ransomware": false,
      "cvss": null,
      "epss": null,
      "verdict": "act",
      "score": 86,
      "reasons": [
        "On CISA KEV (confirmed exploitation in the wild)",
        "Affects a product that is usually internet-facing"
      ],
      "action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follo",
      "oneLine": "Cisco Secure Email Gateway SQL Injection Vulnerability — Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s .",
      "stacks": [],
      "ageDays": 9,
      "rank": 4,
      "movement": "down",
      "daysOnList": 6
    },
    {
      "cve": "CVE-2026-87491",
      "vendor": "Google",
      "product": "Chromium V8",
      "name": "Google Chromium V8 Out of Bounds Write Vulnerability",
      "dateAdded": "2026-09-09",
      "dueDate": "2026-09-23",
      "ransomware": false,
      "cvss": null,
      "epss": null,
      "verdict": "act",
      "score": 86,
      "reasons": [
        "On CISA KEV (confirmed exploitation in the wild)",
        "CISA remediation deadline in 0 day(s)"
      ],
      "action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follo",
      "oneLine": "Google Chromium V8 Out of Bounds Write Vulnerability — Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s .",
      "stacks": [],
      "ageDays": 14,
      "rank": 5,
      "movement": "same",
      "daysOnList": 6
    },
    {
      "cve": "CVE-2025-39964",
      "vendor": "Linux",
      "product": "Kernel",
      "name": "Linux Kernel Race Condition Vulnerability",
      "dateAdded": "2026-09-18",
      "dueDate": "2026-09-21",
      "ransomware": false,
      "cvss": 7.8,
      "epss": 0.0079,
      "verdict": "act",
      "score": 85,
      "reasons": [
        "On CISA KEV (confirmed exploitation in the wild)",
        "CVSS 7.8 (high)"
      ],
      "action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follo",
      "oneLine": "Linux Kernel Race Condition Vulnerability — Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s .",
      "stacks": [
        "linux"
      ],
      "ageDays": 5,
      "rank": 6,
      "movement": "new",
      "daysOnList": 1
    },
    {
      "cve": "CVE-2026-53266",
      "vendor": "Linux",
      "product": "Kernel",
      "name": "Linux Kernel Out-of-Bounds Write Vulnerability",
      "dateAdded": "2026-09-18",
      "dueDate": "2026-09-21",
      "ransomware": false,
      "cvss": 8.8,
      "epss": 0.00276,
      "verdict": "act",
      "score": 85,
      "reasons": [
        "On CISA KEV (confirmed exploitation in the wild)",
        "CVSS 8.8 (high)"
      ],
      "action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follo",
      "oneLine": "Linux Kernel Out-of-Bounds Write Vulnerability — Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s .",
      "stacks": [
        "linux"
      ],
      "ageDays": 5,
      "rank": 7,
      "movement": "new",
      "daysOnList": 1
    },
    {
      "cve": "CVE-2026-85706",
      "vendor": "GitLab",
      "product": "Community Edition and Enterprise Edition",
      "name": "GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability",
      "dateAdded": "2026-09-11",
      "dueDate": "2026-09-14",
      "ransomware": false,
      "cvss": null,
      "epss": null,
      "verdict": "act",
      "score": 83,
      "reasons": [
        "On CISA KEV (confirmed exploitation in the wild)",
        "Affects a product that is usually internet-facing"
      ],
      "action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follo",
      "oneLine": "GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability — Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s .",
      "stacks": [],
      "ageDays": 12,
      "rank": 8,
      "movement": "same",
      "daysOnList": 6
    },
    {
      "cve": "CVE-2026-86060",
      "vendor": "MikroTik",
      "product": "RouterOS",
      "name": "MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability",
      "dateAdded": "2026-09-10",
      "dueDate": "2026-09-13",
      "ransomware": false,
      "cvss": null,
      "epss": null,
      "verdict": "act",
      "score": 82,
      "reasons": [
        "On CISA KEV (confirmed exploitation in the wild)",
        "Affects a product that is usually internet-facing"
      ],
      "action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follo",
      "oneLine": "MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerabilit — Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s .",
      "stacks": [],
      "ageDays": 13,
      "rank": 9,
      "movement": "same",
      "daysOnList": 6
    },
    {
      "cve": "CVE-2026-67277",
      "vendor": "MikroTik",
      "product": "RouterOS",
      "name": "MikroTik RouterOS Missing Authentication for Critical Function Vulnerability",
      "dateAdded": "2026-09-10",
      "dueDate": "2026-09-13",
      "ransomware": false,
      "cvss": null,
      "epss": null,
      "verdict": "act",
      "score": 82,
      "reasons": [
        "On CISA KEV (confirmed exploitation in the wild)",
        "Affects a product that is usually internet-facing"
      ],
      "action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follo",
      "oneLine": "MikroTik RouterOS Missing Authentication for Critical Function Vulnerability — Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s .",
      "stacks": [],
      "ageDays": 13,
      "rank": 10,
      "movement": "same",
      "daysOnList": 2
    }
  ]
}